Description

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-01T13:20:06.423Z",
  "pubdate": "2026-09-01T13:20:06.423Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the Document Object Model (DOM) Core and HTML components of the Firefox browser.\nThe vulnerability occurs when memory is accessed after it has been deallocated, which can lead to arbitrary code execution, system crashes, or data corruption.\nThis flaw affects Firefox 155 and Firefox ESR 153.2 and earlier versions.\nExploitation typically requires an attacker to lure a user into visiting a malicious webpage designed to trigger the invalid memory reference.\nGiven the nature of UAF vulnerabilities, successful exploitation can allow a remote attacker to bypass browser security sandboxes, potentially achieving execution of arbitrary code with the privileges of the browser process.\nThe risk is considered severe as it undermines the memory safety mechanisms of the browser's rendering engine.",
  "technicalDetails": "The vulnerability is classified as a Use-After-Free (UAF) condition located within the DOM Core and HTML parsing components. In the context of browser architecture, a UAF occurs when the browser's memory manager deallocates an object, but a pointer to that object remains in active use or is reachable through the DOM tree.\nThe root cause involves a failure in the lifecycle management of DOM objects during specific parsing or manipulation sequences. When a DOM element is freed—often due to an asynchronous event, a specific DOM mutation, or garbage collection—the application logic fails to nullify or update references pointing to the memory address of the freed object.\nThe exploitation flow typically begins with heap grooming, where an attacker manipulates the memory layout of the browser's heap to ensure that a predictable object is allocated into the memory space previously occupied by the freed DOM element. By triggering the execution path that references the 'dangling' pointer, the attacker redirects the browser to interact with a new, attacker-controlled object instead of the original DOM element.\nBecause the browser believes it is still operating on a valid DOM element, it proceeds to invoke methods or access fields based on the corrupted state. This leads to type confusion or arbitrary read/write primitives. By carefully crafting the attacker-controlled object (e.g., using fake virtual method tables), the attacker can hijack control flow, redirecting execution to malicious shellcode or existing gadgets (Return-Oriented Programming).\nThis vulnerability is reachable via remote web content, meaning a user navigating to a compromised site satisfies the requirements for triggering the flaw. It does not require local authentication. The impact is significant as it affects the core rendering logic, which is high-privilege code within the content process. Successful exploitation facilitates process-level execution, allowing the bypass of the browser's sandbox if combined with additional vulnerabilities or if the browser environment lacks sufficient mitigation deployment."
}